Concentrated parity technique for handling double failures and enabling storage of more than one parity block per stripe on a storage device of a storage array

ABSTRACT

A method for constructing an extended array of storage devices that enables storage of more than one parity block per stripe on a single device of the array is disclosed. Each device is divided into blocks. The blocks are organized into stripes across the devices, wherein each stripe contains a first number of parity blocks from each of a second number of parity storage devices of the array. Data blocks are stored on a third number of data storage devices, to thereby construct the array to enable storage of more than one parity block per stripe on a single device, wherein the extended array is recoverable from any one or two storage device failures.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present invention is a continuation of U.S. patent applicationSerial No. 10/008,497, filed on Nov. 13, 2001 and now issued as U.S.Pat. No. 6,851,082, granted Feb. 1, 2005, which is related to U.S.patent application Serial No. 10/008,565 titled, Parity AssignmentTechnique for Parity Declustering in a Parity Array of a Storage System,which was filed on Nov. 13, 2001, now U.S. Pat. No. 7,346,831, grantedon Mar. 18, 2008 and which application is hereby incorporated byreference as though fully set forth herein.

CROSS-REFERENCE TO RELATED APPLICATION

The present invention is related to the following co-pending andcommonly assigned U.S. patent application Ser. No. 10/008,565 titled,Parity Assignment Technique for Parity Declustering in a Parity Array ofa Storage System, which was filed on even date herewith and whichapplication is hereby incorporated by reference as though fully setforth herein.

FIELD OF THE INVENTION

The present invention relates to arrays of storage systems and, morespecifically, to a technique for efficiently reconstructing any one orcombination of two failing storage devices of a storage array.

BACKGROUND OF THE INVENTION

A file server is a computer that provides file service relating to theorganization of information on writeable persistent storage devices,such memories, tapes or disks of an array. The file server or filer maybe embodied as a storage system including a storage operating systemthat implements a file system to logically organize the information as ahierarchical structure of directories and files on the disks. Each“on-disk” file may be implemented as set of data structures, e.g., diskblocks, configured to store information, such as the actual data for thefile. A directory, on the other hand, may be implemented as a speciallyformatted file in which information about other files and directoriesare stored.

A storage system may be further configured to operate according to aclient/server model of information delivery to thereby allow manyclients to access files stored on a server, e.g., the storage system. Inthis model, the client may comprise an application executing on acomputer that “connects” to the storage system over a computer network,such as a point-to-point link, shared local area network, wide areanetwork or virtual private network implemented over a public network,such as the Internet. Each client may request the services of the filesystem on the storage system by issuing file system protocol messages(in the form of packets) to the system over the network. It should benoted, however, that the storage system may alternatively be configuredto operate as an assembly of storage devices that is directly-attachedto a (e.g., client or “host”) computer. Here, a user may request theservices of the file system to access (i.e., read and/or write) datafrom/to the storage devices.

A common type of file system is a “write in-place” file system, anexample of which is the conventional Berkeley fast file system. In awrite in-place file system, the locations of the data structures, suchas data blocks, on disk are typically fixed. Changes to the data blocksare made “in-place” in accordance with the write in-place file system.If an update to a file extends the quantity of data for the file, anadditional data block is allocated.

Another type of file system is a write-anywhere file system that doesnot over-write data on disks. If a data block on disk is retrieved(read) from disk into memory and “dirtied” with new data, the data blockis stored (written) to a new location on disk to thereby optimize writeperformance. A write-anywhere file system may initially assume anoptimal layout such that the data is substantially contiguously arrangedon disks. The optimal disk layout results in efficient accessoperations, particularly for sequential read operations, directed to thedisks. An example of a write-anywhere file system that is configured tooperate on a storage system, such as a filer, is the Write Anywhere FileLayout (WAFL™) file system available from Network Appliance, Inc.,Sunnyvale, Calif. The WAFL file system is implemented as a microkernelwithin an overall protocol stack of the filer and associated diskstorage.

The disk storage is typically implemented as one or more storage“volumes” that comprise a cluster of physical storage disks, defining anoverall logical arrangement of disk space. Each volume is generallyassociated with its own file system. The disks within a volume/filesystem are typically organized as one or more groups of Redundant Arrayof Independent (or Inexpensive) Disks (RAID). RAID implementationsenhance the reliability/integrity of data storage through the writing ofdata “stripes” across a given number of physical disks in the RAIDgroup, and the appropriate storing of redundant information with respectto the striped data. The redundant information enables recovery of datalost when a storage device fails.

In the operation of a disk array, it is fairly common that a disk willfail. A goal of a high performance storage system is to make the meantime to data loss (MTTDL) as long as possible, preferably much longerthan the expected service life of the system. Data can be lost when oneor more storage devices fail, making it impossible to recover data fromthe device. Typical schemes to avoid loss of data include mirroring,backup and parity protection. Mirroring is an expensive solution interms of consumption of storage resources, such as hard disk drives.Backup does not protect recently modified data. Parity schemes arecommon because they provide a redundant encoding of the data that allowsfor a single erasure (loss of one disk) with the addition of just onedisk drive to the system.

Parity protection is used in computer systems to protect against loss ofdata on a storage device, such as a disk. A parity value may be computedby summing (usually modulo 2) data of a particular word size (usuallyone bit) across a number of similar disks holding different data andthen storing the results on an additional similar disk. That is, paritymay be computed on vectors 1-bit wide, composed of bits in correspondingpositions on each of the disks. When computed on vectors 1-bit wide, theparity can be either the computed sum or its complement; these arereferred to as even and odd parity respectively. Addition andsubtraction on 1-bit vectors are equivalent to an exclusive-OR (XOR)logical operation, and the addition and subtraction operations arereplaced by XOR operations. The data is then protected against the lossof any of the disks. If the disk storing the parity is lost, the paritycan be regenerated from the data. If one of the data disks is lost, thedata can be regenerated by adding the contents of the surviving datadisks together and then subtracting the result from the stored parity.

Typically, the disks are divided into parity groups, each of whichcomprises one or more data disks and a parity disk. A parity set is aset of blocks, including several data and one parity block, where theparity block is the XOR of all the data blocks. A parity group is a setof disks from which one or more parity sets are selected. The disk spaceis divided into stripes, with each stripe containing one block from eachdisk. The blocks of a stripe are usually at the same locations on eachdisk in the parity group. Within a stripe, all but one block are blockscontaining data (“data blocks”) and one block is a block containingparity (“parity block”) computed by the XOR of all the data. If theparity blocks are all stored on one disk, thereby providing a singledisk that contains all (and only) parity information, a RAID-4implementation is provided. If the parity blocks are contained withindifferent disks in each stripe, usually in a rotating pattern, then theimplementation is RAID-5. The term “RAID” and its variousimplementations are well-known and disclosed in A Case for RedundantArrays of Inexpensive Disks (RAID), by D. A. Patterson, G. A. Gibson andR. H. Katz, Proceedings of the International Conference on Management ofData (SIGMOD), June 1988.

As used herein, the term “encoding” means the computation of aredundancy value over a predetermined subset of data blocks, whereas theterm “decoding” means the reconstruction of a data or parity block bythe same or similar process as the redundancy computation using a subsetof data blocks and redundancy values. If one disk fails in the paritygroup, the contents of that disk can be decoded (reconstructed) on aspare disk or disks by adding all the contents of the remaining datablocks and subtracting the result from the parity block. Since two'scomplement addition and subtraction over 1-bit fields are bothequivalent to XOR operations, this reconstruction consists of the XOR ofall the surviving data and parity blocks. Similarly, if the parity diskis lost, it can be recomputed in the same way from the surviving data.

An aspect of parity protection of data is that it provides protectionagainst only a single disk failure within a parity group. These schemescan also protect against multiple disk failures as long as each failureoccurs within a different parity group. However, in the case of multiplesimultaneous failures within a parity group, no such protection isprovided and an unrecoverable loss of data is suffered. Failure of twodisks concurrently within a parity group is a fairly common occurrence,particularly because disks “wear out” and because of environmentalfactors with respect to the operation of the disks. In this context, thefailure of two disks concurrently within a parity group is referred toas a “double failure”.

A double failure typically arises as a result of a failure to one diskand a subsequent failure to another disk while attempting to recoverfrom the first failure. The recovery or reconstruction time is dependentupon the level of activity of the storage system. That is, duringreconstruction of a failed disk, it is desirable that the storage systemremain “online” and continue to serve requests (from clients or users)to access (i.e., read and/or write) data. If the storage system is busyserving requests, the elapsed time for reconstruction increases. Thereconstruction processing time also increases as the number of disks inthe storage system increases. Moreover, the double disk failure rate isproportional to the square of the number of disks in a parity group.However, having small parity groups is expensive, as each parity grouprequires an entire disk devoted to redundant data.

Accordingly, it is desirable to provide a technique that withstandsdouble failures. This would allow construction of larger disk systemswith larger parity groups, while ensuring that even if reconstructionafter a single disk failure takes a long time (e.g., a number of hours),the system can survive a second failure. Such a technique would furtherallow relaxation of certain design constraints on the storage system.For example, the storage system could use lower cost disks and stillmaintain a high MTTDL. Lower cost disks typically have a shorterlifetime, and possibly a higher failure rate during their lifetime, thanhigher cost disks. Therefore, use of such disks is more acceptable ifthe system can withstand double disk failures within a parity group.

A known scheme for protecting against double disk failures is adistributed parity scheme disclosed in U.S. Pat. No. 5,862,158, titledEfficient Method for Providing Fault Tolerance Against Double DeviceFailures in Multiple Device Systems, by Baylor et al., issued Jan. 19,1999, which patent is hereby incorporated by reference as though fullyset forth herein. This distributed parity scheme, hereinafter referredto as the “Corbett-Park” scheme, provides a way of determining theassignment of each data block to exactly two parity sets, such that allparity sets are the same size. The scheme also allows recovery from anytwo disk failures using an optimal amount of parity information,equivalent to two disks worth, for any even number of disks 4 orgreater, except 8.

The Corbett-Park technique further allows a tradeoff between the optimalamount of parity and the number of data blocks that belong to eachparity set, i.e., the number of data blocks XOR'ed to compute eachparity block. For a given number of disks n in the array, a ratio m maybe selected, which is the number of data blocks per parity block. Thus,the redundancy is 1/(m+1) and the parity overhead is 1/m, wherein m isrestricted such that 2 m+2≦n. Within each recurrence of the parityassignment pattern, each disk has m data blocks and one parity block.Without losing generality, assume that the data blocks are in m rows andthe parity blocks are in a single row. A stripe is composed of m+1 rows.Therefore, there is a minimum of n/(m+1)=(2 m+2)/(m+1)=2 disks worth ofparity, which is the optimal amount. If n is made larger than 2 m+2,then there is more than the minimum parity in the parity array, but theoverhead and redundancy may be maintained by keeping m constant.

It should be noted that for the Corbett-Park scheme, the sizes of theblocks used in the parity computations do not have to match the sizes ofany system blocks. Therefore, the blocks used for parity computation canbe chosen to be some convenient size. For example, assume it is desiredthat each recurrence of the parity assignment pattern contain exactly 4kilobytes (kB) of data from each disk. The sizes of the blocks used forparity computation can thus be defined as 4 k/(m+1), which works well ifm=3, 7 or 15 when the block size is a larger power of two, such as 4 k(4096) bytes.

The result of the Corbett-Park parity assignment construction techniqueis that within each row of a stripe, the data block on disk i belongs toparity sets (i+j) mod n and (i+k) mod n, where j≠k, 0<j<n and 0<k<n. Theparity block for parity set p is stored on disk p, wherein 0≦p<n. Thedifference between values j and k is a parity delta, wherein a paritydelta is the difference in value modulo the number of disks between twoparity sets to which a data block belongs. Note that this form of moduloarithmetic is preferably “wrap around” addition, which is similar todiscarding carries in an XOR operation.

Specifically, parity offset is defined as, in a row, the differences jand k between a disk number d and the parity sets to which a blockbelongs, such that set1=(d+j) mod n and set2=(d+k) mod n. Here, j and kare the parity offsets. Parity offsets are between 1 and n−1, inclusive.Parity delta, on the other hand, is defined as the difference, modulo n,between the parity offsets j and k for a row of blocks. The paritydeltas for a row are (j−k) mod n and (k−j) mod n. Parity deltas arebetween 1 and n−1, inclusive, and n/2 is not allowed, as are otherfactors of n depending on the depth of the parity blocks per stripe inthe relocated parity arrangement.

Among all the m rows of data blocks, all the deltas must be unique.Furthermore, in cases of even values of n, delta of n/2 is not allowed.Therefore, for m rows, there are 2×m unique deltas required. Given n−1possible deltas in the case of odd n, and n−2 possible deltas in thecase of even n, there is a restriction on the maximum size of m and,hence, on the minimum redundancy ratio for a given number of disks. Theassignment of two unique parity deltas to each row of a stripe asdescribed herein ensures five conditions:

1. Each data block belongs to two unique parity sets.

2. The m data blocks on each disk belong to 2×m different parity sets.

3. No data block on a given disk belongs to the parity set of the parityblock on that disk.

4. All parity sets are of the same size. Since each data block belongsto exactly the minimum number 2 parity sets, a corollary is that allparity sets are of minimum size.

5. On each disk, there is at least one parity set that is notrepresented by either a data or parity block.

These conditions are necessary, but not sufficient to ensure that thearray contents can be reconstructed after two device failures. The 5thcondition is key to reconstruction. When two disks are lost, there arealways at least two parity sets for which only one block is lost andwhich allow for reconstruction of the missing block. If n=2 m+2, thereare exactly two parity sets that are only missing one member. If n>2m+2, there are more than two parity sets that are only missing onemember and, in fact, some parity sets may be complete and require noreconstruction. Therefore reconstruction can always begin byreconstructing two of the missing blocks, one from each of the faileddisks. If the reconstructed blocks are data blocks, then eachreconstructed data block allows reconstruction of the missing block fromanother parity set, since each data block belongs to two parity sets.Each reconstruction “chain” is continued until a parity block isreconstructed.

FIG. 1 is a block diagram of a prior art 4-disk array 100 configured inaccordance with the Corbett-Park distributed parity arrangement. Eachdisk is assigned parity and data blocks that are organized into stripesand assigned to parity sets. For example, each stripe contains twoblocks, a data (D) block and a parity (P) block, with the parity anddata block assignment patterns repeated for each stripe. Each parityblock stores the parity for one parity set and each parity set hasexactly one parity block. All parity sets are of equal size and arecomposed, in addition to the parity block, of several data blocks. Eachdata block is defined to be a member of two parity sets. No two datablocks in the array are both members of the same two parity sets. Nomore than one data block or parity block on any given disk belongs toany one parity set.

In the case of any single failure, no parity set misses more than oneblock and therefore all parity sets, and consequently all missingblocks, can be reconstructed. If any one of the disks fails, the lostdata and parity blocks can be reconstructed, since at most one block ismissing from all parity sets. Moreover, if any two disks fail, all themissing blocks can be generated from the remaining parity and data onthe other two disks.

For example, if disks 0 and 1 fail, parity sets 1 and 2 are each missingtwo blocks and cannot be reconstructed immediately. However, each parityset 0 and 3 is missing only one block and therefore the missing blocksof these parity sets can be reconstructed. Reconstructing data block D23(the missing data block from parity set 3) results in the reconstructionof a data block member of parity set 2 which, in turn, allowsreconstruction of data block D12 on disk 0. By reconstructing data blockD12, the parity block of parity set 1 on disk 1 can be reconstructed.Note that the parity blocks end the reconstruction chains. That is, fora double failure (two disk failures) there are always two reconstructionchains; recovery is effected by reconstructing the data blocks prior tothe parity blocks of those chains, and then reconstructing the twoparity blocks of the two failed disks.

Assume now that disks 0 and 2 fail. Each parity set 0 and 2 is missingtwo blocks, while each parity set 1 and 3 is missing only one block.Therefore, the missing blocks of parity sets 1 and 3 can bereconstructed immediately. In particular, the missing data block D12from parity set 1 can be reconstructed which enables reconstruction ofparity block 2 on disk 2. Similarly, missing data block D30 from parityset 3 can be reconstructed, which enables reconstruction of parity block0 on disk 0. Therefore, there are again two chains that arereconstructed starting with the missing data block and ending with theparity block.

FIG. 2 is a block diagram of a prior art 6-disk array 200 configured inaccordance with the Corbett-Park distributed parity arrangement. Eachdisk is divided into data and parity blocks that are further organizedinto stripes. Each stripe contains two data blocks and one parity block,and there is an optimal amount of parity information equivalent to twodisks worth. Each data block belongs to two parity sets and there isonly one (at most) representative member of each parity set on eachdisk. Notably, each disk is missing one parity set and the missingparity set is different among all the disks. Furthermore, each row ofblocks within each stripe has a different parity delta. For example, row1 has a parity delta of Δ1 and row 2 has a parity delta of Δ2. The samedelta is not allowed on two different rows because it renders the systemvulnerable to disk failures that distance apart.

Specifically, the Corbett-Park construction technique specifies thatevery row of data blocks in the parity array has a different paritydelta value and that no row's delta value equals n/2. For example, in a6-disk array, no row has a delta value of 3 (Δ3); similarly in a 10-diskarray, no row has a delta value of 5 (Δ5). A parity delta cannot have avalue of n/2 there cannot be a “harmonic” of parity set assignments to adata block within an array. It should be noted, however, that each rowessentially has a pair of parity delta values. That is, in the case of a10-disk array, a delta value of Δ3 is equivalent to a delta value of Δ7,and a delta value of Δ4 is equivalent to a delta value of Δ6. Similarly,in a 6-disk array, a delta value of Δ1 is equivalent to a delta value ofΔ5 and a delta value of Δ2 is equivalent to a delta value of Δ4.

The Corbett-Park construction technique also requires finding a vectorof n elements containing two each of the symbols from 1 to m thatrepresent the data blocks, one symbol for parity (e.g., −1) and anotherset of symbols for null values (e.g., 0). The object is to find an nelement vector that allows a complete marking of all symbols in thevector and all super-positions of the vector on itself. A vector thatsuccessfully meets the criteria corresponds to a solution of the parityassignment problem for a given n and m that allows recovery from anydouble disk failure.

FIG. 3 is a table 300 illustrating construction of parity assignments ina parity array from a successful vector in accordance with theCorbett-Park construction technique. The vector is {−1, 1, 0, 2, 2, 1},which is one of four unique solutions for n=6, m=2 (discountingcongruent solutions). Each column of the table represents a disk andeach row represents a parity set. The positions of the symbols in eachcolumn indicate the assignment of the data blocks 1 and 2, along withthe parity block −1, to a parity set in that disk. Symbol 1 representsthe data blocks in row 1 and the symbol 2 represents the data blocks inrow 2 of a stripe. The data and parity blocks may be arranged in anyorder within each disk. The parity assignment vector is rotated by oneposition in each disk ensuring that it occupies all n possible positionsin the n disk array. FIG. 4 is a block diagram illustrating the parityassignment pattern resulting from the construction technique.

As noted, the Corbett-Park technique provides a means for assigning datablocks to parity sets in a distributed parity configuration having anoptimal amount or sub-optimal amount of parity and a chosen redundancyratio. That is, for a given number of disks, an optimal amount of parityis chosen to be equal to 2/n. However for odd numbers of disks n thereare solutions that are sub-optimal (i.e., more than two disks worth ofparity) but that operate correctly. For example, if n=7 and each disk isdivided into three blocks (two data blocks and one parity block), thereis a total of 7/3 of parity which is greater than two disks worth andthus a sub-optimal solution resulting in increased redundancy.Increasing redundancy has two effects: (1) the size of the parity setsis smaller than the maximum allowed for a given number of disks, thuseffectively “declustering” the parity. As n increases, there are moreparity sets that are not affected at all by the failures. Particularlyin the more common case of single failures, this might result in fewerdisk read operations during reconstruction. (2) There are more than twoparity sets that only lose one block in the event of the failures,increasing the parallelism possible during reconstruction.

A disadvantage of increasing redundancy is that there is more totalparity information than the minimum two disks worth. However, in a largesystem, there will be many parity arrays and hence much more than theminimum two disks worth of parity in the entire system. Larger values ofm allow more data blocks per parity block, decreasing the amount ofredundant space on disk. Yet, the parity set size is always 2 m+1,including data and parity blocks. Therefore, the larger m, the morecomputation needed to compute each parity block, both during encodingand decoding (i.e., construction and deconstruction). Since each datablock belongs to exactly two parity sets in all cases, the total amountof parity computation is always the same for the same amount of data.

SUMMARY OF THE INVENTION

The present invention comprises a concentrated parity technique forconstructing an extended array that is tolerant of any one or twostorage device failures and that enables storage of more than one parityblock on each storage device of the array. The concentrated paritytechnique uses a distributed parity assignment of data blocks to paritysets, with a restriction that precludes certain parity deltas. Yet, thisrestriction enables construction of the extended array having datablocks stored on a first set of devices that is disjoint from a secondset of devices storing parity blocks, to thereby enable storage of morethan one parity block per stripe on a single device.

According to the inventive technique, the parity blocks, separated bythe precluded parity deltas, can be stored on similar devices. Forexample in all cases where n is an even number of devices, parity blocksthat are n/2 apart (parity delta) can be stored on the same device ofthe extended array. By further restricting other parity deltas, anynumber of parity blocks may be stored on the same device. Theconcentrated parity arrangement may, however, create an unbalancedparity stripe “array” of data and parity blocks across the devices.According to another aspect of the present invention, a plurality ofunbalanced parity stripe arrays may be combined to thereby produce asingle balanced parity “super-stripe” array across the devices.

Advantageously, the inventive concentrated parity technique utilizesparity protection to provide an extended array that protects against allsingle and double failures, where a single failure is a loss of onedevice, such as a disk, and a double failure is a loss of two devices atany time. The inventive technique further allows the extended array tobe configured with a smaller number of data devices and, as additionaldata devices are needed, those devices can be added individually or insmall groups without moving any data blocks or reconfiguring orre-computing any parity. Although the extended array arrangement mayresult in an increase in redundancy, the inventive technique enables acorresponding increase in parallelism during reconstruction of thefailed disk(s).

BRIEF DESCRIPTION OF THE DRAWINGS

The above and further advantages of the invention may be betterunderstood by referring to the following description in conjunction withthe accompanying drawings in which like reference numerals indicateidentical or functionally similar elements:

FIG. 1 is a block diagram of a first, prior art disk array configured inaccordance with a conventional distributed parity arrangement;

FIG. 2 is a block diagram of a second, prior art disk array configuredin accordance with the conventional distributed parity arrangement;

FIG. 3 is a table illustrating construction of parity assignments in aparity array from a vector in accordance with a prior art constructiontechnique;

FIG. 4 is a block diagram illustrating a parity assignment patternresulting from the prior art construction technique;

FIG. 5 is a schematic block diagram of an environment including a fileserver that may be advantageously used with the present invention;

FIG. 6 is a schematic block diagram of a storage operating systemincluding a write anywhere file layout (WAFL) file system layer that maybe advantageously used with the present invention;

FIG. 7 is a block diagram of data and parity blocks of a balanced stripearray according to a concentrated parity technique of the presentinvention;

FIG. 8 is a block diagram illustrating parity assignments for a diskarray in accordance with the present invention;

FIG. 9 is a block diagram illustrating a balanced parity super-stripearray in accordance with the invention; and

FIG. 10 is a block diagram illustrating a balanced parity super stripearray configuration adapted for large write operations in accordancewith the present invention.

DETAILED DESCRIPTION OF AN ILLUSTRATIVE EMBODIMENT

FIG. 5 is a schematic block diagram of an environment 500 including afile server, such as a network storage appliance, that may beadvantageously used with the present invention. The file server or filer520 is a computer that provides file service relating to theorganization of information on storage devices, such as disks 530 of adisk array 560. The filer 520 comprises a processor 522, a memory 524, anetwork adapter 526 and a storage adapter 528 interconnected by a systembus 525. The filer 520 also includes a storage operating system 600 thatimplements a file system to logically organize the information as ahierarchical structure of directories and files on the disks.

In the illustrative embodiment, the memory 524 comprises storagelocations that are addressable by the processor and adapters for storingsoftware program code and data structures associated with the presentinvention. The processor and adapters may, in turn, comprise processingelements and/or logic circuitry configured to execute the software codeand manipulate the data structures. The storage operating system 600,portions of which are typically resident in memory and executed by theprocessing elements, functionally organizes the filer by, inter alia,invoking storage operations in support of a file service implemented bythe filer. It will be apparent to those skilled in the art that otherprocessing and memory means, including various computer readable media,may be used for storing and executing program instructions pertaining tothe inventive technique described herein.

The network adapter 526 comprises the mechanical, electrical andsignaling circuitry needed to connect the filer 520 to a client 510 overa computer network 540, which may comprise a point-to-point connectionor a shared medium, such as a local area network. The client 510 may bea general-purpose computer configured to execute applications 512.Moreover, the client 510 may interact with the filer 520 in accordancewith a client/server model of information delivery. That is, the clientmay request the services of the filer, and the filer may return theresults of the services requested by the client, by exchanging packets550 encapsulating, e.g., the Common Internet File System (CIFS) protocolor Network File System (NFS) protocol format over the network 540.

The storage adapter 528 cooperates with the storage operating system 600executing on the filer to access information requested by the client.The information may be stored on any type of attached array of writeablemedia such as video tape, optical, DVD, magnetic tape, bubble memory andany other similar media adapted to store information, including data andparity information. In the illustrative embodiment described herein,however, the information is preferably stored on the disks 530 of array560. The storage adapter includes input/output (I/O) interface circuitrythat couples to the disks over an I/O interconnect arrangement, such asa conventional high-performance, Fibre Channel serial link topology. Theinformation is retrieved by the storage adapter and, if necessary,processed by the processor 522 (or the adapter 528 itself) prior tobeing forwarded over the system bus 525 to the network adapter 526,where the information is formatted into a packet and returned to theclient 510.

Storage of information on array 560 is preferably implemented as one ormore storage “volumes” that comprise a cluster of physical storage disks530, defining an overall logical arrangement of disk space. Each volumeis generally associated with its own file system. The disks within avolume/file system are typically organized as one or more groups ofRedundant Array of Independent (or Inexpensive) Disks (RAID). RAIDimplementations enhance the reliability/integrity of data storagethrough the redundant writing of data “stripes” across a given number ofphysical disks in the RAID group, and the appropriate storing of parityinformation with respect to the striped data.

To facilitate access to the disks 530, the storage operating system 600implements a write-anywhere file system that logically organizes theinformation as a hierarchical structure of directories and files on thedisks. Each “on-disk” file may be implemented as a set of disk blocksconfigured to store information, such as data, whereas the directory maybe implemented as a specially formatted file in which other files anddirectories are stored. In the illustrative embodiment described herein,the storage operating system is preferably the NetApp® Data ONTAP™operating system available from Network Appliance, Inc., Sunnyvale,Calif. that implements a Write Anywhere File Layout (WAFL™) file system.It is expressly contemplated that any appropriate file system can beused, and as such, where the term “WAFL” is employed, it should be takenbroadly to refer to any file system, database or data storage systemthat is otherwise adaptable to the teachings of this invention.

FIG. 6 is a schematic block diagram of the Data ONTAP operating system600 that may be advantageously used with the present invention. Thestorage operating system comprises a series of software layers,including a media access layer 610 of network drivers (e.g., an Ethernetdriver). The operating system further includes network protocol layers,such as the Internet Protocol (IP) layer 612 and its supportingtransport mechanisms, the Transport Control Protocol (TCP) layer 614 andthe User Datagram Protocol (UDP) layer 616. A file system protocol layerprovides multi-protocol data access and, to that end, includes supportfor the CIFS protocol 618, the NFS protocol 620 and the HypertextTransfer Protocol (HTTP) protocol 622. In addition, the storageoperating system 600 includes a disk storage layer 624 that implements adisk storage protocol, such as a RAID protocol, and a disk driver layer626 that implements a disk access protocol such as, e.g., a SmallComputer Systems Interface (SCSI) protocol.

Bridging the disk software layers with the network and file systemprotocol layers is a WAFL layer 680 that preferably implements the WAFLfile system. The on-disk format representation of the WAFL file systemis block-based using, e.g., 4 kilobyte (kB) blocks and using inodes todescribe the files. The WAFL file system uses files to store meta-datadescribing the layout of its file system; these meta-data files include,among others, an inode file. A file handle, i.e., an identifier thatincludes an inode number, is used to retrieve an inode from disk.

Operationally, a request from the client 510 is forwarded as, e.g., aconventional CIFS or NFS protocol packet 550 over the computer network540 and onto the filer 520 where it is received at the network adapter526. A network driver of the media access layer 610 processes thepacket, passes it onto the network protocol layers 612-616 and CIFS orNFS layer 618, 620 for additional processing prior to forwarding to theWAFL layer 680. Here, the WAFL file system generates operations to load(retrieve) the requested data from disk 530 if it is not resident“incore”, i.e., in the memory 524. If the information is not in memory,the WAFL layer 680 indexes into the inode file using the inode number toaccess an appropriate entry and retrieve a logical volume block number(VBN). The WAFL layer then passes the logical VBN to the disk storage(RAID) layer 624, which maps that logical number to a disk block numberand sends the latter to an appropriate driver (e.g., SCSI) of the diskdriver layer 626. The disk driver accesses the disk block number fromdisk 530 and loads the requested data block(s) in memory 524 forprocessing by the filer. Upon completion of the request, the filer (andoperating system) returns a reply to the client 510 over the network540.

It should be noted that the software “path” through the storageoperating system layers described above needed to perform data storageaccess for the client request received at the filer may alternatively beimplemented in hardware. That is, in an alternate embodiment of theinvention, the storage access request data path 650 may be implementedas logic circuitry embodied within a field programmable gate array(FPGA) or an application specific integrated circuit (ASIC). This typeof hardware implementation increases the performance of the file serviceprovided by filer 520 in response to a file system request packet 550issued by client 510. Moreover, in another alternate embodiment of theinvention, the processing elements of adapters 526, 528 may beconfigured to offload some or all of the packet processing and storageaccess operations, respectively, from processor 522, to thereby increasethe performance of the file service provided by the filer. It isexpressly contemplated that the various processes, architectures andprocedures described herein can be implemented in hardware, firmware orsoftware.

As used herein, the term “storage operating system” generally refers tothe computer-executable code operable to perform a storage function in astorage system, e.g., that implements file system semantics and managesdata access. In this sense, the ONTAP software is an example of such astorage operating system implemented as a microkernel and including theWAFL layer to implement the WAFL file system semantics and manage dataaccess. The storage operating system can also be implemented as anapplication program operating over a general-purpose operating system,such as UNIX® or Windows NT®, or as a general-purpose operating systemwith configurable functionality, which is configured for storageapplications as described herein.

In addition, it will be understood to those skilled in the art that theinventive technique described herein may apply to any type ofspecial-purpose (e.g., server) or general-purpose computer, including astandalone computer, embodied as or including a storage system. To thatend, filer 520 is hereinafter described as an exemplary implementationof a storage system 520. Moreover, the teachings of this invention canbe adapted to a variety of storage system architectures including, butnot limited to, a network-attached storage environment, a storage areanetwork and disk assembly directly-attached to a client or hostcomputer. The term “storage system” should therefore be taken broadly toinclude such arrangements in addition to any subsystem configured toperform a storage function and associated with other equipment orsystems.

The present invention comprises a concentrated parity technique thatutilizes parity protection to protect against all single and doublefailures, where a single failure is a loss of one storage device, suchas disk 530, and a double failure is a loss of two disks 530 of array560. The novel technique is preferably implemented by the disk storage(RAID) layer 624 that assigns data blocks to parity sets in accordancewith a conventional distributed parity technique. The RAID layercooperates with the WAFL layer 680 to divide the disks 530 into data andparity blocks that are then organized as RAID groups through theredundant writing of stripes across the disks, wherein each stripecontains data and parity blocks from each of the disks. To that end, theWAFL layer generally performs large write operations, writing oroverwriting an entire stripe of a parity array at once. The contents ofthe stripe, including the parity blocks, are computed in memory beforethe stripe is written to disk.

In the illustrative embodiment of a WAFL-based file system and process,a RAID-4 implementation is advantageously employed. This implementationspecifically entails the striping of data across a group of disks, andseparate parity caching within selected disk(s) of the RAID group. Theillustrative RAID-4 implementation of the disk array as described hereinprovides the flexibility to start with an under-populated disk array,and add disks individually or in small numbers until a fully populatedarray is achieved. This is possible because an initial situation may beassumed wherein the array has a finite number of imaginary data disks,all containing zeros. With a single parity disk, data disks can be addeduntil the size of a stripe becomes too large to buffer effectively.

The present invention is directed to a RAID-4 style technique where alldata is stored on a subset of disks in a parity group and all parity isstored on a disjoint subset of disks. This may be accomplished by firstnoting that all the rows of parity blocks may be removed from theoriginal disks of the array and moved to the disjoint set of disks ofthe “extended” array. Such an extended array would still be tolerant ofdouble failures because any two data disks failing would result in lessloss of information than would have occurred if the parity blocks werestill mixed with the data blocks. Any loss of a disk containing a parityblock would similarly be easier to recover from than if both the parityand data from the original disk were lost.

Therefore, the present invention comprises a concentrated paritytechnique that enables construction of an extended array of disks havinga data block portion that is maintained on an original set of disks,while a parity block portion of the array is contained on a physicallyseparate, i.e., disjoint, set of disks. Within the set of parity disksthat is disjoint from the set of disks storing the data blocks, theinvention enables storage of more than one parity block on each disk.Referring to the parity assignment pattern for the 6-disk array of FIG.2, a redundancy ratio of 1/3 is provided, i.e., one third of the diskstorage is occupied by parity. The disks employ a distributed parityconfiguration as indicated by one parity block and two data blocks perdisk (per stripe). One way of achieving the novel concentrated parityarrangement is to take all the parity blocks P0-P5 and place them on sixparity disks that are disjoint from the original six disks containingthe data blocks. Here, the redundancy ratio of the novel arrangementremains the same. However the amount of parity is not optimal withrespect to the total disk storage occupied by parity as 6 disks, insteadof 2 disks, contain parity.

Although the concentrated parity configuration described above istolerant of double failures, it may create unbalanced disk lengths withrespect to the blocks per disk per stripe. According to an aspect of theinvention, the parity blocks may be further combined and arranged suchthat all disks contain the same number of blocks (e.g., two) to therebyprovide a balanced stripe “array” across the disks. FIG. 7 is a blockdiagram of data and parity blocks of a balanced stripe array 700according to the concentrated parity technique of the present invention.Here, parity blocks P0 and P3 are both stored within a disk, as areparity blocks P1 and P4, and parity blocks P2 and P5. This“self-contained” stripe of data and parity may be repeated in arecurring pattern across all the disks. Notably, the combination ofparity blocks represents the only functional arrangement for the 6-diskarray system.

Specifically, the difference of the combined parity blocks on eachparity disk is 3. A parity delta of Δ3 is prohibited for a row of datablocks because it results in a non-functional arrangement. A delta of Δ3is non-functional (i.e., does not work) for a row of data blocks becauseit ascribes two data blocks having positions of exactly half the lengthof the array apart to exactly the same parity set assignments. If twodisks half the length of the array apart were lost, then two data blockmembers of the same two parity sets are lost, thereby obviating recoveryof the lost data. Row 1 of the parity array thus has a delta of Δ1 androw 2 has a delta of Δ2.

The assignment prohibition of certain parity deltas to data blocksdescribed above also applies to the conventional Corbett-Parkdistributed parity arrangement. However, it is this prohibition(restriction) that provides the basis of the novel concentrated parityvariant of that conventional technique. In other words, the conventionalCorbett-Park construction technique specifies that for an even number ofdisks n, there are no deltas of n/2. By excluding a parity delta valueof n/2 from assignments to data blocks, the present invention allowscertain parity blocks (i.e., those having a difference of n/2) to becombined on the same disk, since no data block can be in both of theparity sets separated by n/2.

For example in the case of a 6-disk system, the parity blocks can beremoved from the original disks and combined on disjoint disks only ifthe parity block parity assignments are separated by 3, while the datablock parity assignments are maintained as originally assigned. Thus,the present invention allows parity blocks having a delta of Δ3 to becombined on parity disks 6-8 of array 700. Note that when a parity diskis lost, two parity blocks from each stripe are lost. According to anaspect the inventive technique, the two lost parity blocks should notbelong to the two parity sets to which any disk block belongs. Thisaspect of the invention is guaranteed because no disk block is assignedto two parity sets that are separated by a delta of Δ3. This aspect isalso key to the inventive concentrated parity technique, particularlyfor a write anywhere file system that utilizes a RAID-4 styleconcentrated parity arrangement. Yet, it should be noted that the novelconcentrated parity arrangement may apply to any type of file system,including a write in-place file system, having any type of attachedarray of any type of writeable persistent storage media, such as videotape, optical, DVD, magnetic tape and bubble memories.

According to another aspect of the present invention, more than twoparity blocks may be combined onto a single parity disk within eachstripe. By precluding the assignment of certain deltas to data blocksthat are a factor of n (where n=the total number of data disks in thearray), the corresponding parity blocks may be grouped together.Ideally, it is desirable to combine the parity blocks into n/m diskswith m parity blocks on each disk, as this would provide a match betweenthe size of the data disks and the size of the parity disks. Therecurring pattern would have m blocks on each disk, either data orparity. For certain factors f₁,f₂ of n, where f₁×f₂=n, solutions areavailable that allow placement of f₁ parity blocks on f₂ dedicatedparity disks. The restriction is that the pair of deltas in each row ofdata blocks must obey the following relationship, where i and j are thetwo pasty deltas for a row:

-   -   (i−j) mod n≠k f₂, for any value of k such that 0<k f₂<n

In other words, the restriction specifies no Δ=k f₂ for a row of datablocks. A feature of the inventive technique is that once values of nand m are established, it is necessary to find only one operationalcombination of parity deltas. That combination can be used in theencoding process in all arrays. It can be shown that the restrictiondescribed herein results in a configuration where no parity diskcontains two parity blocks to which any one data block belongs.

As a result, the loss of any one parity disk and any one data disk canbe tolerated. This is because, at most, one data block is lost from eachof the two parity sets to which each data block belongs, as per theconditions of array construction applied from the original Corbett-Parkscheme. In addition, no more than one of the two parity blocks is lostto which each lost data block belongs, as per this technique. So, thelost data disk can be first reconstructed from surviving data andparity, and then the lost parity disk can be reconstructed fromsurviving and reconstructed data.

If two parity disks are lost, reconstruction is possible simply byrecalculating the lost parity blocks from the surviving data blocks,since all the data blocks must have survived in any two disk failureswhere the two failed disks are both parity disks.

If two data disks are lost, then less information is lost than wouldhave been lost in the corresponding loss of two disks in the originalCorbett-Park scheme. In fact, the same data blocks and none of theparity blocks would have been lost. Thus, by applying the first steps ofthe Corbett-Park recovery algorithm, all of the lost data blocks can bereconstructed.

For example, assume a 12-disk array with redundancy of 1 parity blockfor every 4 data blocks. This array can be configured as a RAID-5 stylearray according to the original Corbett-Park scheme with 4 data blocksand 1 parity block in each recurrence of the parity assignment patternper disk. According to the invention, the parity blocks can be strippedfrom the 12-disk array and placed, 4 blocks per disk, on 3 additionalparity disks, thereby creating a RAID-4 style array. This resulting15-disk array includes 12 data disks and 3 parity disks. Although thereis more than the minimum two disks of parity in the array, the ratio ofparity to data is unchanged from the original 12 disk array and theparity set size is unchanged. There are more disks but there is alsomore space for data on the original 12 disks. An advantage of thistechnique is that the array can be configured with a smaller number(than 12) of data disks and, as additional data disks are needed, thosedisks can be added individually or in small groups without moving anydata blocks or reconfiguring or re-computing any parity. The noveltechnique simply “assumes” that all 12 data disks are present from thebeginning and that any disks that aren't actually present in the arrayare filled with, e.g., zero values.

An example of the restriction specified by the inventive technique is asfollows. Assume that a 15-disk array is configured as 12 data disks and3 parity disks. Since f₂=3 and no Δ=k f₂ is allowed, deltas having avalue of Δ3, Δ6 or Δ9 are not allowed for assignment of data blocks toparity sets. Given that restriction, parity blocks P0, P3, P6 and P9 canbe combined onto one parity disk, parity blocks P1, P4, P7, P10 can becombined onto another parity disk and parity blocks P2, P5, P8, P11 canbe combined onto a third parity disk. In essence, the restrictionspecifies that, depending upon the number of parity disks (f₂), therecannot be any multiple of that number (k f₂) used as a parity delta forthe data blocks. By precluding data block parity set assignments ofmultiples of the parity disk (e.g., 3, 6 and 9 for a 12-disk array), theinventive concentrated parity technique allows combining of parityblocks having those differences, modulo n, on a single disk.

FIG. 8 is a table 800 illustrating a solution of parity assignments fora 15-disk array having 12 data disks and 3 parity disks, with aredundancy ratio of 4 to 1, in accordance with the present invention.Each row represents the contents of one row of the recurring pattern ofparity assignment on disk. The numbers associated with each data andparity block are the parity sets to which that block is assigned. Ifeach of the blocks in the table is 1 k, for example, then the patternrecurs every 4 k bytes and the entire stripe, including parity, may becomputed in memory by buffering 15×4=60 k bytes of data. In addition,all parity for that stripe may be computed in memory 524 prior toperforming one large write operation to the disks.

In each data disk, 4 of the 12 parity sets are not represented. Also, noparity set is represented twice on a disk. Furthermore, no data blockbelongs to two parity sets for which the parity blocks are stored on thesame parity disk. As noted, this is key to the success of the inventivetechnique, as no more than two members of any parity set can be lostwith just two disk failures and at least 4 parity sets will always loseonly one member. From there, it may be demonstrated that the loss of anypair of disks can be recovered by sequentially reconstructing datablocks as missing members of each parity set are filled.

As an example of a reconstruction sequence, assume that disks 0 and 1are lost to failure. Two members of parity sets 2, 3, 4, 9, 10 and 11are lost and one member of parity sets 0, 1, 5 and 8 is lost. BlocksB1,9 and B8,10 from disk 0 can immediately be reconstructed, as canblock B5,0 from disk 1. Completing the reconstruction of block B1,9allows the reconstruction of block B9,11, and then block B4,11.Completing block B8,10 allows reconstruction of block B2,10, then blockB2,3, then block B3,4, thereby completing the reconstruction of the lostdata. Note that the parity deltas among all the rows are unique. This isa general restriction on the overall solution to the concentrated paritytechnique. Note also that in this parity assignment, there are no paritydeltas of Δ3, Δ6 or Δ9 in any row of data blocks. This, in turn, allowsthe grouping of four different parity sets on each parity disk.

According to the inventive concentrated parity technique, it is possibleto construct a “balanced” array where all the disks of the array havethe same amount of information contained thereon, whether data orparity. For example, referring to the concentrated parity configurationof FIG. 7, each of the 9 disks, (6 data and 3 parity disks) contain thesame amount of information (two blocks) for each stripe across thedisks. When the stripe is repeated multiple times across the disks, thedisks are filled uniformly and, accordingly, all the disks may be of thesame size, thereby providing a balanced array. Notably, the array 700 isbalanced after one repetition of a stripe.

However, assume that for a 10-disk array, there are 5 blocks per diskper stripe that results in 5 rows of blocks per stripe across the 10disks of the array. Assume further that the last row of blocks acrossthe 10 disks comprises parity blocks according to the originalCorbett-Park scheme. Then assume that those blocks are removed from the10 data disks and placed on a disjoint set of 5 parity disks, whereineach parity disk contains two parity blocks. The resulting arraycomprises 10 data disks, each with 4 blocks per stripe, and 5 paritydisks, each with 2 blocks per stripe, that collectively form a firstunbalanced parity stripe array. It should be evident to those skilled inthe art that such a parity arrangement can be constructed in accordancewith the techniques of this invention and that this array will tolerateany two disk failures.

In accordance with an aspect of the present invention, a secondunbalanced parity stripe array having 10 data disks, each with 4 blocks,and 5 parity disks, each with 2 blocks, may be combined with the firstunbalanced parity stripe array to thereby form a balanced parity“super-stripe” array. FIG. 9 is a block diagram illustrating a balancedparity super-stripe array 900 in accordance with the invention. Theresulting balanced super-stripe array comprises 25 disks, 20 of whichare data disks and 5 of which are parity disks, wherein each disk has 4blocks per stripe.

Thus, if the depth of the parity disks is some integer fraction of thedepth of the data disks, the parity information from two or moredifferent disk arrays can be combined onto one set of the parity blocks.In an alternate embodiment of the invention, the parity from each of theunbalanced parity stripe arrays can be combined onto the same 5 paritydisks, interleaving parity from each disk array in groups of two blocks.The entire set of 25 disks may be considered as a single array for largewrite operation purposes, writing out a large stripe 4 blocks deep by 25blocks wide with 80 data blocks on 20 data disks and 20 parity blocks on5 parity disks. FIG. 10 is a block diagram illustrating such a balancedarray configuration 1000 adapted for large write operations inaccordance with the present invention.

While there has been shown and described an illustrative embodiment forconstructing an array having a data block portion that is maintained ona set of storage devices that is disjoint from the set of devicesholding the parity block portion, it is to be understood that variousother adaptations and modifications may be made within the spirit andscope of the invention. For example, in yet another alternate embodimentof the invention, three or more unbalanced parity stripe arrays may becombined to form a balanced parity super-stripe array. Assume anunbalanced parity stripe array wherein each of the data devices (disks)has 6 data blocks and each of the parity devices (disks) has 2 datablocks. By combining three of these unbalanced parity stripe arraysaccording to the inventive technique, a balanced parity super-stripearray may be formed. Notably, the invention does not require that all ofthe constituent disks of a large balanced array be physicallycontiguous/adjacent, although they must be logically organized.

The foregoing description has been directed to specific embodiments ofthis invention. It will be apparent, however, that other variations andmodifications may be made to the described embodiments, with theattainment of some or all of their advantages. Therefore, it is theobject of the appended claims to cover all such variations andmodifications as come within the true spirit and scope of the invention.

1. A method for constructing an array of storage devices comprising:dividing each of the devices into blocks; storing data blocks on a firstset of the devices; storing more than one parity block on each of asecond set of the devices; forming a plurality of parity sets whereineach parity set includes a plurality of data blocks selected from lessthan all of the first set of devices and a parity block that is computedparity for the plurality of data blocks, and each data block belongingto two parity sets; and organizing the array so that: i) no data blockbelongs to two parity sets having parity blocks on the same device ofthe second set of the devices; and ii) the array is recoverable from anyone or two device failures.
 2. The method of claim 1 wherein the devicesare disks.
 3. The method of claim 1, further comprising: assigning thedata blocks to parity sets, each parity set contains at least one datablock and a parity block.
 4. The method of claim 3, further comprising:defining the parity sets, including the data and parity blocks withinstripes in the first and second sets of devices.
 5. The method of claim4 wherein the first set of devices is a set of data devices and thesecond set of devices is a set of parity devices, and wherein each datadevice contains one or more blocks of a stripe and each parity devicecontains the same or fewer blocks from the stripe.
 6. The method ofclaim 5, further comprising: numbering each parity set from 0 to n−1,where n is the number of data devices.
 7. The method of claim 6, furthercomprising: precluding assignment of certain parity deltas to the datablocks.
 8. The method of claim 7 wherein the storing comprises storingthe parity blocks separated by the precluded parity deltas on the singledevice of the second set.
 9. The method of claim 8, further comprising:configuring the array with a predetermined number of devices.
 10. Themethod of claim 9 wherein the predetermined number of devices is an evennumber n and wherein one of the precluded parity deltas is n/2.
 11. Themethod of claim 1 wherein storing comprises creating an unbalancedstripe array of data and parity blocks across the devices.
 12. Themethod of claim 11 further comprising the step of combining a pluralityof unbalanced stripe arrays to thereby produce a single balancedsuper-stripe array across the devices.
 13. An array of storage devices,comprising: a plurality of storage devices, each device of the pluralityof storage devices divided into blocks that stripe the data into aplurality of data blocks, the data blocks stored on data devices andparity blocks stored on parity devices; a storage operating systemincluding a device storage layer configured to implement a concentratedparity technique that forms a plurality of parity sets wherein eachparity set includes a plurality of data blocks selected from less thanall of the data devices and a parity block that is computed parity forthe plurality of data blocks, where each data block belongs to twoparity set, the array organized so that: i) no data block belongs to twoparity sets having parity blocks on a same parity devices; and ii) thearray is recoverable from any one or two devices; and a processingelement configured to execute the operating system to thereby invokestorage access operations to and from the array in accordance with theconcentrated parity technique.
 14. The system of claim 13 wherein eachparity set contains at least one data block and a parity block, whileprecluding assignment of certain parity deltas to the data blocks. 15.The system of claim 14 wherein the device storage layer further storesthe parity blocks separated by the precluded parity deltas on a singledevice of the second set.
 16. The system of claim 15 wherein the storagedevices are media adapted to store information contained within the dataand parity blocks.
 17. A computer readable medium containing executableprogram instructions for constructing an array of storage devices,comprising: program instructions that divide each device into blocks;program instructions that store data blocks on a first set of thedevices; program instructions that store more than one parity block oneach of a second set of devices; program instructions that form aplurality of parity sets wherein each parity set includes a plurality ofdata blocks selected from less than all of the first set of devices anda parity block that is computed parity for the plurality of data blocks,and each data block belonging to two parity sets; and programinstructions that organize the array so that: i) no data block belongsto two parity sets having parity blocks on the same device of the secondset of devices; and ii) the array is recoverable from any one or twodevice failures.
 18. A method for storing parity for a plurality ofstorage devices, comprising: dividing each device of the plurality ofdevices into blocks; storing data into a plurality of data blocks,wherein the data blocks are stored on a first set of data devices;storing parity blocks on a second set of parity devices; organizing theplurality of data blocks and parity blocks into a plurality of paritysets, wherein each parity set includes a particular group of data blocksselected from less than all of the first set of data devices and aparticular parity block that is computed parity for the group of datablocks, and each data block belongs to two parity sets; and organizingthe first set of data devices and the second set of parity devices in anarray so that: i) no data block belongs to two parity sets having parityblocks on the same parity device; and ii) any one or two device failuresis recoverable.
 19. A method comprising: dividing each device of aplurality of devices into blocks; storing a plurality of data blocks ona first set of data devices; storing more than one parity block on eachof a second set of parity devices; forming a plurality of parity sets,wherein each parity set includes a plurality of data blocks selectedfrom less than all of the first set of devices and a parity block thatis computed parity for the plurality of data blocks, and each data blockbelonging to two parity sets; and organizing the first set of datadevices and the second set of parity devices to construct an unbalancedstripe array so that: i) no data block belongs to two parity sets havingparity blocks on the same parity device; and ii) any one or two devicefailures is recoverable.